chore: move committed-generated-artifact freshness checks to lint:ci (#2000)

gsd-test's build leg runs the full 'npm run build' (which regenerates
capability-registry.cjs, loop-host-contract.cjs, package-identity.cjs, etc.),
so committed-freshness guards that lived in the unit suite were masked there:
gsd-test passed a stale-commit that CI's shard-1/3 test then red-flagged
(caught live on PR #1998). The mandated pre-push gate was green on a commit
CI correctly flagged.

Move the committed-state --check guards into a new 'lint:generated-sync'
script wired into lint:ci (the single orchestrated entry point the lint-tests
CI job already runs on a build:lib-only tree, so the committed artifacts are
checked without regeneration). gsd-test no longer contains these guards, so
it can no longer mask them.

- package.json: add lint:generated-sync (7 generators --check); wire into lint:ci.
- generate-package-identity.cjs: add --check mode (was the only generator
  without it); no-arg behaviour unchanged (still writes, as build expects).
- Remove the committed-freshness guards from the unit suite, keeping all
  behavioral/structural tests:
    - capability-registry.test.cjs: drop the --check describe.
    - loop-host-contract.test.cjs: drop the committed-file staleness test
      (keep the normalizeLineEndings unit test).
    - capability-matrix-sync.test.cjs: drop --check + byte-for-byte (keep the
      architectural content invariants: every cap appears, security ship:pre).
    - issue-844-manifest-version-sync.test.cjs: drop describe D (--check).
    - issue-498-package-identity.test.cjs: drop the drift-check test (keep
      behavioral module-export tests); drop the now-unused render import and
      its allow-test-rule exemption (allowlist ratcheted 175 -> 174).

scripts/generate-package-identity.cjs

@@ -114,12 +114,37 @@ function render(identity) {
 function main() {
   const fs = require('node:fs');
   const path = require('node:path');
+  const args = process.argv.slice(2);
+  const check = args.includes('--check');
   const pkg = require(path.join(__dirname, '..', 'package.json'));
   const out = path.join(__dirname, '..', 'gsd-core', 'bin', 'lib', 'package-identity.cjs');
-  fs.writeFileSync(out, render(deriveIdentity(pkg)));
+  const rendered = render(deriveIdentity(pkg));
+  if (check) {
+    // Compare normalized content so a CRLF checkout (Windows, no .gitattributes
+    // eol rule) does not register as stale. Mirrors the in-process check the
+    // unit suite used to perform (issue #498) and the convention used by the
+    // other gen-* --check generators.
+    const norm = (s) => s.replace(/\r\n/g, '\n');
+    let committed = '';
+    try {
+      committed = fs.readFileSync(out, 'utf8');
+    } catch (e) {
+      if (e.code !== 'ENOENT') throw e;
+    }
+    if (norm(committed) !== norm(rendered)) {
+      process.stderr.write('package-identity.cjs is stale — run: node scripts/generate-package-identity.cjs\n');
+      return 1;
+    }
+    return 0;
+  }
+  fs.writeFileSync(out, rendered);
   process.stdout.write(`wrote ${path.relative(path.join(__dirname, '..'), out)}\n`);
+  return 0;
 }
 
-if (require.main === module) main();
+if (require.main === module) {
+  const code = main();
+  if (typeof code === 'number' && code !== 0) process.exitCode = code;
+}
 
 module.exports = { deriveIdentity, parseRepoSlug, slugifyPackageName, formatManualInstall, render, main };

scripts/lint-allow-test-rule-refs.allowlist.json

@@ -88,7 +88,6 @@
   "tests/ios-scaffold-safety.test.cjs :: source-text-is-the-product",
   "tests/issue-2639-codex-toml-neutralization.test.cjs :: source-text-is-the-product",
   "tests/issue-429-comment-text-gate.test.cjs :: source-text-is-the-product",
-  "tests/issue-498-package-identity.test.cjs :: architectural-invariant",
   "tests/issue-498-update-backup-runtime-dir.test.cjs :: structural assertion on the deployed update.md backup bash;",
   "tests/issue-57-runtime-install-no-drift.test.cjs :: delegation-presence guard. Catches wholesale removal of the registry",
   "tests/issue-57-runtime-install-no-drift.test.cjs :: structural guard over bin/install.js source. Behavioral assertions",